diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml index 53289f1c2e..753d8513fd 100644 --- a/.github/workflows/pypi-release.yml +++ b/.github/workflows/pypi-release.yml @@ -6,7 +6,13 @@ on: env: RELEASE_TAG: ${{ github.event.release.tag_name }} - GITHUB_BRANCH: master + PYTHON_VERSION: 3.11 + CACHE: "poetry" + # This base branch is used to create a PR with the updated version + # We'd need to handle the base branch for v4 and v3, since they will be + # `master` and `3.0-dev`, respectively + GITHUB_BASE_BRANCH: "master" + GIT_COMMITTER_EMAIL: "sergio@prowler.com" jobs: release-prowler-job: @@ -15,56 +21,86 @@ jobs: POETRY_VIRTUALENVS_CREATE: "false" name: Release Prowler to PyPI steps: - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v4 - with: - ref: ${{ env.GITHUB_BRANCH }} + - name: Install dependencies run: | pipx install poetry pipx inject poetry poetry-bumpversion - - name: setup python + + - name: Setup Python uses: actions/setup-python@v5 with: - python-version: 3.9 - cache: 'poetry' - - name: Change version and Build package + python-version: ${{ env.PYTHON_VERSION }} + cache: ${{ env.CACHE }} + + - name: Update Poetry and config version run: | poetry version ${{ env.RELEASE_TAG }} + + - name: Import GPG key + uses: crazy-max/ghaction-import-gpg@v4 + with: + gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} + passphrase: ${{ secrets.GPG_PASSPHRASE }} + git_user_signingkey: true + git_commit_gpgsign: true + + - name: Push updated version to the release tag + run: | + # Configure Git git config user.name "github-actions" - git config user.email "" + git config user.email "${{ env.GIT_COMMITTER_EMAIL }}" + + # Add the files with the version changed git add prowler/config/config.py pyproject.toml - git commit -m "chore(release): ${{ env.RELEASE_TAG }}" --no-verify - git tag -fa ${{ env.RELEASE_TAG }} -m "chore(release): ${{ env.RELEASE_TAG }}" + git commit -m "chore(release): ${{ env.RELEASE_TAG }}" --no-verify -S + + # Replace the tag with the version updated + git tag -fa ${{ env.RELEASE_TAG }} -m "chore(release): ${{ env.RELEASE_TAG }}" --sign + + # Push the tag git push -f origin ${{ env.RELEASE_TAG }} + + + - name: Create new branch for the version update + run: | + git switch -c release-${{ env.RELEASE_TAG }} + git push --set-upstream origin release-${{ env.RELEASE_TAG }} + + - name: Build Prowler package + run: | poetry build - - name: Publish prowler package to PyPI + + - name: Publish Prowler package to PyPI run: | poetry config pypi-token.pypi ${{ secrets.PYPI_API_TOKEN }} poetry publish - # Create pull request with new version - - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 - with: - token: ${{ secrets.PROWLER_ACCESS_TOKEN }} - commit-message: "chore(release): update Prowler Version to ${{ env.RELEASE_TAG }}." - branch: release-${{ env.RELEASE_TAG }} - labels: "status/waiting-for-revision, severity/low" - title: "chore(release): update Prowler Version to ${{ env.RELEASE_TAG }}" - body: | - ### Description + + - name: Create PR to update version in the branch + run: | + echo "### Description This PR updates Prowler Version to ${{ env.RELEASE_TAG }}. ### License - By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. - - name: Replicate PyPi Package + By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license." |\ + gh pr create \ + --base ${{ env.GITHUB_BASE_BRANCH }} \ + --head release-${{ env.RELEASE_TAG }} \ + --title "chore(release): update Prowler Version to ${{ env.RELEASE_TAG }}." \ + --body-file - + env: + GH_TOKEN: ${{ secrets.PROWLER_ACCESS_TOKEN }} + + - name: Replicate PyPI package run: | rm -rf ./dist && rm -rf ./build && rm -rf prowler.egg-info pip install toml python util/replicate_pypi_package.py poetry build + - name: Publish prowler-cloud package to PyPI run: | poetry config pypi-token.pypi ${{ secrets.PYPI_API_TOKEN }}